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Abstract 

We study the multiagent epistemic logic CMAEL(CD) with opera- 
tors for common and distributed knowledge for all coalitions of agents. We 
introduce Hintikka structures for this logic and prove that satisfiability in 
such structures is equivalent to satisfiability in standard models. Using 
this result, we design an incremental tableau based decision procedure for 
testing satisfiability in CMAEL(CD). 

1 Introduction 

Over the last two decades, multiagent epistemic logics have been found to be 
a useful tool for a variety of applications in computer science and AI ([T], 
[S]), the main among them being design, specification, and verification of dis- 
tributed protocols ([6], [5], [2]). In this paper, we consider the full coalitional 
multiagent epistemic logic, involving modal operators for individual knowledge 
for each agenlj^, as well as operators for common and distributed knowledge 
among any (non-empty) coalition of agents; we call that logic CMAEL(CD)(j. 
Most of the multiagent epistemic logics studied so far only cover fragments of 
CMAEL(CD); e.g., the logic considered in [2 contains, besides the individ- 
ual knowledge modalities, the operator of distributed knowledge only for the 
whole set of agents in the language, while [5] extends that system with common 
knowledge operator for the whole set of agents. As far as we know, no provably 
complete deductive system or a decision procedure has been developed so far 
for CMAEL(CD), although [T] propose (without proof) an axiomatic system 
which is presumed to be complete for this logic. 

One of the major issues in applying multiagent epistemic logics to design of 
distributed systems is the development of algorithms for constructive checking 
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of formulae of those logics for satisfiability, i.e, checking if a formula is satis- 
fiable and, if so, constructing a model for it. The main purpose of this paper 
is to develop a tableau-based algorithm for the constructive satisfiability prob- 
lem for CMAEL(CD). In the recent precursor (|3j) to the present paper, we 
have developed such an algorithm for the multiagent epistemic logic with op- 
erators of individual knowledge, as well as common and distributed knowledge 
for the set of all agents. In the present paper, we extend the results of [4] to 
MAEL(CD). The main challenge in such an extension lies in handling the op- 
erators of distributed knowledge parameterized by coalitions of agents. Thus, 
even though the style of the tableaux presented here is similar to the ones from 
[1], the proof of correctness of the procedure required more involved model- 
theoretic techniques building on those used in [2]. Consequently, the present 
paper substantially focuses on overcoming challenges raised by the presence in 
the language of coalitional distributed knowledge modalities. 

The satisfiability-checking algorithms of both ^ and the present paper are 
based on the incremental tableaux in the style first proposed in [10| and adapted 
recently to logics of strategic ability in multiagent systems in [3]. Besides our 
conviction that this approach to building decision procedures for logics of mul- 
tiagent systems is practically most optimal, the uniformity of method and style 
of these tableaux is deliberate, as it reflects our intention to eventually inte- 
grate them into a tableau-based decision procedure for comprehensive logical 
systems for reasoning about knowledge, time, and strategic abilities of agents 
and coalitions in multiagent systems. 

The structure of the paper is as follows: Section[2]presents the syntax and se- 
mantics of CMAEL(CD); in Sections[3]and[4l we introduce Hintikka structures 
for this logic and prove that satisfiability in Hintikka structures is equivalent to 
satisfiability in models. Then, in Sections and [SI we develop the tableau proce- 
dure for testing satisfiability of CMAEL(CD)-formulae and sketch proofs of its 
soundless, completeness, and termination, and briefly estimate its complexity. 
We illustrate our tableau procedure with two examples in the Appendix. 

2 Syntax and semantics of the logic CMAEL(CD) 

The language C of CMAEL(CD) contains a (flnitc or countable) set AP of 
atomic propositions, whose arbitrary members we typically denote hy p, q,r, . . .; 
a finite, non-empty set S of names of agents, whose arbitrary members we 
typically denote by a,b . . . and whose subsets, called coalitions, we typically 
denote by A,B,... (possibly with decorations); a sufficient repertoire of the 
Boolean connectives; and, for every non-empty coalition A, the modal operators 
("ii is distributed knowledge among A that . . .") and Ca C^it is common 
knowledge among A that ..."). The formulae of C are thus defined as follows: 

(f := p \ ^ip \ {ipi A ip2) I 'Da^P I CaV^ 

where p ranges over AP and A ranges over non-empty subsets of S; the set 
of all such subsets will henceforth be denoted by V^(T^). The other Boolean 
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connectives can be defined as usual. We denote formulae of C by ip,ip,x, ■ ■ ■ 
(possibly with decorations) and omit parentheses in formulae whenever it does 
not result in ambiguity. We write ip G C to mean that (/? is a formula of C. 

The distributed knowledge operator D^tp intuitively means that a "super- 
agent" , somebody who knows everything that any of the agents in A knows, 
can obtain ip as a logical consequence of his knowledge. For example, if agent 
a knows tjj and agent b knows ■0 ~* Xj then T>^a,b}X is true even though neither 
a nor b knows x- The operators of individual knowledge l^af {^^ agent a knows 
that (/j"), for a G S, can then be defined as D^^jji^, henceforth written Da</3. 

The common knowledge operator Ca^ means that ip is "public knowledge" 
among A, i.e., that every agent in A knows (/?, and knows that every agent in A 
knows ip, etc. For example, it is common knowledge among drivers that green 
light means "go" and red light means "stop" . Formulae of the form -iC^(^ are 
referred to as (epistemic) eventualities, for the reasons given later on. 

Formulae of C are interpreted over coalitional multiagent epistemic mod- 
els. In this paper, we also need the auxiliary notions of coalitional multiagent 
epistemic structures and frames, which we now define. 

Definition 2.1 A coalitional multiagent epistemic structure ( CMAES, for short) 
is a tuple 6 = {E, S, {n^}Aev+{^), {'^A}Aev+{^)), where 

1. S is a finite, non-empty set of agents; 

2. S ^ ^ is a set of states,- 

3. for every A G TZ^ is a binary relation on S; 

4- for every A G TZ'^ is the reflexive, transitive closure of [J a'CA^a'- 

Definition 2.2 A coalitional multiagent epistemic frame ( CMAEF) is a CMAES 
5" = {Yj,S,{TI^]a£V+{t.)t{T^'^}a£V+{t.))! where each TZ^ is an equivalence re- 
lation satisfying the following condition: 

(t) = n aeAK 

If condition (\ ) above is replaced by the following, weaker, one: 

(tt) T^A ^ T^B whenever B C A, 
then ^ is a coalitional multiagent epistemic pseudo-frame (pseudo-CMAEF) . 

Note that in every (pseudo-)CMAEF C f] aeA^a ^ and hence 

U A'caRa' = U aeARa ■ Thus, condition (4) of Definition 12.11 is equivalent to 
requiring that, in (pseudo-)CMAEFs, 7?.^ is the transitive closure of |J aeA^f , 
for every A G 'P+(S). Moreover, each 7^^ in a (pseudo-) CMAEF is an equiva- 
lence relation. 

Definition 2.3 A coalitional multiagent epistemic model (CMAEM) is a tuple 
A4 = {^,AP,L), where ^ is a CMAEF, AP is a set of atomic propositions, and 
L : S ^ T'{AP) is a labeling function, assigning to every state s the set L{s) of 
atomic propositions true at s. If ^ is a pseudo-CMAEF, then A4 = (JS,AP,L) 
is a multiagent coalitional pseudo-model (pseudo- CMAEM) . 
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The satisfaction relation between (pseudo-)CMAEMs, states, and formulae 
is defined in the standard way. In particular, 

• M,s Ih DAf iff {s,t) e TZ^ implies M,t Ih 

• M,s Ih CAif iff e TZ^ implies M,t Ih ip. 

Definition 2.4 Given a (pseudo-)CMAEM M. and Lp ^ C, we say that (p is 
satisfiable in Ai if M., s\\- Lp holds for some s ^ Ai and say that p is valid in 
Ai if Ai,s \\~ p) holds for every s G A4. Satisfiability and validity in a class of 
(pseudo-)models are defined accordingly. 

The truth condition for the operator can be re-stated in terms of reach- 
ability. Let be a (pseudo-)CMAEF with state space 5* and let s, i G S. We 
say that t is A-reachable from s if either s = t or, for some n > 1, there exists 
a sequence s = sq,si,. .. ,s„_i,s„ = t of elements of S such that, for every 
< i < n, there exists a ^ A such that (si, Sj+i) £ i?f . It is then easy to see 
that the following truth condition for Ca is equivalent to the one given above: 

• Ai, s Ih Cap iff A4, t\\-p whenever t is A-reachable from s. 

Note also, that if E = {a}, then 'Da'fi ^ CaP is valid for all p ^ C. Thus, 
the single-agent case is trivialized and, therefore, we assume throughout the 
remainder of the paper that E contains at least 2 agents. 

3 Hintikka structures 

Despite our ultimate interest in satisfiability of finite sets of formulae in CMAEMs, 
the tableaux we present check for the existence of a more general kind of seman- 
tic structure for Q than a model, namely a Hintikka structure. In this section, 
we show that Hintikka structures satisfy the same sets of formulae as pseudo- 
CMAEMs; in the next section, we show that CMAEMs satisfy the same sets 
of formulae as pseudo-CMAEMs. Consequently, testing for satisfiability in a 
Hintikka structure can replace testing for satisfiability in a CMAEM. In the 
following discussion, for brevity, we only consider single formulae; the extension 
to finite sets of formulae is straightforward. 

The most fundamental difference between (pseudo-)models and Hintikka 
structures is that while the former specify the truth value of every formula 
of C at each state, the latter only do so for the formulae relevant to the eval- 
uation of a fixed formula 9. Another important difference is that the accessi- 
bility relations in (pseudo-) models must satisfy the explicitly stated conditions 
of Definition 12.21 while in Hintikka structures conditions are only imposed on 
the labels of the states in such a way that every Hintikka structure generates, 
through the construction of Lemma 13.51 below, a pseudo-CMAEM so that the 
"truth" of formulae in the labels is preserved in the resultant pseudo-model. To 
define Hintikka structures, we need the following auxiliary notion. 
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Definition 3.1 A set A C C is fully expanded if it satisfies the following 
conditions: 

• if G A, then ip € A; 

• if (f Alp & A, then (p & A and tjj S A; 

• if -i(<^ A S A, then -i<p e A or -^ip G A; 

• ifDAf G A, then Da'V € A for every A' such that A C A' C S; 

• ifDAV G ^! then (p G A; 

• if Ca<P € A, then Da(v A Ca<p) G A for every a G A; 

• if ^CaV G a, then -^T)a{f A Caijo) e A /or some a G A; 

• i/-iDA^DB(^ e A, then D(AnB)f G A. 

Definition 3.2 A coalitional multi-agent cpistcmic Hintikka structure ( CMAEHS 
for short) is a tuple (S, S, {7^^}^g-p+(x;), {'7^5}Ae'P+(s)i -ff) such that 
(S. 5, {7?,^}^gp+(x;), {7?.a}agp+(s)) ^ CMAES, and H is a labeling of the 
elements of S with sets of formulae of C satisfying the following constraints: 

HI if G H{s), then ^p ^ H{s), for every s G S; 

H2 II{s) is fully expanded, for every s G S; 

H3 if ^D^(p G H{s), then there exists t € S such that {s,t) G TZ'^ and -k^ G 

H{t); 

H4 G TlJ, i/ien Da'<^ G -H"(s) iffDA'^P e ^^W, M even/ A' C A; 

H5 z/ -iC^t/? G -ff(s), t/ien f/iere exists t G S such that {s,t) G 7^5 ^'^^ ^ 
H{t). 

Definition 3.3 Let 9 € C, Q C C, and H be a CMAEHS with state space S. 
We say that H is a CMAEHS for 9, or that is satisfiable in K, if 9 G H{s) 
for some s G 5; we say that 6 is satisfiable inH i/6 C H{s). 

We now prove that ^ G £ is satisfiable in a pseudo-CMAEM iff there ex- 
ists a CMAEHS for 9. Given a pseudo-CMAEM M = {E, S,{n'l}Aev+m, 
{^S}AeP+(s)) AP, L), we define the extended labeling function : S 'Pi'^) 
on A4 as follows: L~^{s) = { <^ | M,s Ih ip}. Then, it is routine to check the 
following. 

Lemma 3.4 Let M. = {E,S,{TZ^}Aev+Cs)A'^A}AGV+(^)j'^PjL) a pseudo- 
CMAEM satisfying 9 and let L~^ be the extended labeling on M.. Then, {T,,S, 
{7^2W+(E),{7^SW+(s),i+) IS a CMAEHS for 9. 

Now, we argue in the opposite direction. 
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Lemma 3.5 Let 9 E C be such that there exists a CMAEHS for 0. Then, is 

satisfiaMe in a pseudo-CMAEM. 

Proof. Let H = (S, S, {7^^}AGP+(E) , {T^SIagp+cs) , H) be an CMAEHS for 0. 
We construct a pseudo-CMAEM Ai' satisfying 6 out of H as follows. 

First, for every A G let TZ'^ be the reflexive, symmetric, and tran- 

sitive closure of |J acbT^b ^^"^ TZ'^' be the transitive closure of |J aeATi-'^ ■ 
Notice that C and 7^5 C for every A € 'P+(S). Second, let 

L{s) = H{s) n AP, for every s G S. It is then easy to check that A4' = 
(S, S, {n'f}Aev+iS),{T^A}Aev+(S),I^P, L) is a pseudo-CMAEM. 

To complete the proof of the lemma, we show, by induction on the structure 
of X e £ that, for every s G S and every x S £, the following hold: 

(i) X G H{s) implies M', s Ih x; 

(ii) ^x G ^(s) imphes Al', s II — ^x- 

Let X be some p € AP. Then, p € H{s) implies p E L(s) and, thus, Ai', s Ih p; 
if, on the other hand, ^p G H{s), then due to (HI), p ^ and thus p ^ I'(s); 
hence, M' , s II — 'p. 

Assume that the claim holds for all subformulae of x; then, we have to prove 
that it holds for x, as well. 

Suppose that x is ~"P- If G H{s), then the inductive hypothesis imme- 
diately gives us M', s II — 'ip; if, on the other hand, -^^f S H{s), then by virtue 
of (H2), ip e H{s) and hence, by inductive hypothesis, A4',s II- and thus 
M',s Ih 

The case of x = 'f' A tjj is straightforward, using (H2). 

Suppose that x is Da<P- Assume, first, that 'Da'P & H{s). In view of the 
inductive hypothesis, it suffices to show that {s,t) G TZ'^ implies t G H{t). So, 
assume that (s,t) G TZ'^ ■ There are two cases to consider. If s = t, then the 
conclusion immediately follows from (H2). If, on the other hand, s ^ t, then 
there exists an undirected path from s to f along the relations TZ^' , where each 
A' is a superset of A. Then, in view of (H4), Da<^ G H{t); hence, by (H2), 
(p € H{t), as desired. 

Assume, next, that -'D^c/? G H{s). In view of the inductive hypothesis, it 
suffices to show that there exist t E S such that (s, t) G TZ'^ and -^ip G H{t). By 
(H3), there exists tGS such that {s,t) G and -^ip e H{t). As 7^2 C 7^^, 
the desired conclusion follows. 

Suppose now that x is Ca'^- Assume that CaV £ H{s). In view of the 
inductive hypothesis, it suffices to show that if t is ^-reachable from s in Ai' , 
then ip G H{t). So, assume that either s = t or, for some n > 1, there exists 
a sequence of states s = sq, si, . . . , s„_i, s„ = t such that, for every < i < n, 
there exists a, G S such that {si,Si+\) G "/^o^- In the former case, the desired 
conclusion follows from (H2). In the latter case, we can show by induction on 
Q<i <n that Da, (^'ACa*/') G H{si). Then, Da„_^(<^ A Ca<p) G fl'(s„_i), and 
thus, in view of (H3) and (H2), if G H{t). 

Assume, on the other hand, that -^Ca'P ^ H{s). Then, the desired conclu- 
sion follows from (H6), the fact that IZ^ C TZ'a , and the inductive hypothesis. 
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Theorem 3.6 Let E C Then. is satisfiable in a pseudo-CMAEM iff there 
exists a CMAEHS for e. 

Proof. Immediately follows from Lemmas 13.41 and 13.51 □ 



4 Equivalence of CMAEMs and pseudo-CMAEMs 

In the present section, we prove that pseudo-CMAEMs and CMAEMs satisfy 
the same sets of formulae. The right-to-left direction is immediate, as every 
CMAEM is a pseudo-CMAEM. For the left-to-right direction, we use a mod- 
ification of the construction from [21 appendix Al] to show that if 6* G £ is 
satisfiable in a pseudo-CMAEM, then it is satisfiable in a "tree-like" pseudo- 
CMAEM that actually turns out to be a bona-fide CMAEM. 

Definition 4.1 Let = {T.,S,{'R^}Aev+(^)A'^A}Aev+(T.),AP,L) he a 

(pseudo-) CMAEM and let s,t d S. A maximal path from s to t in A4 is 
a sequence s — sq, Aq, si, . . . , s„-i, An-i, Sn — t such that, for every < i < n, 
{si, Si+i) € T^A ' ^'^^ i^i' Si+i) £ T^B does not hold for any B with C -B C S. 
A segment p' of a maximal path p starting and ending with a state is a sub-path 
of P- 

Definition 4.2 Let p = sq, . . . , s„ be a maximal path in JV[. The re- 

duction of p is obtained by, first, replacing in p every longest sub-path Sp, Ap, Sp+i, . . . , 
Ap+q-i, Sp+q such that Sp — Sp+i — ... = Sp+q with Sp (i.e., removing loops) 
and, then, by replacing in the resultant path every longest sub-path Sj, Aj, Sj+i, 
. . . Sj+m such that Aj = Aj+i = . . . = Aj+m~i with Sj,Aj,Sj+„i (i.e., 

collapsing multiple consecutive transitions along the same relation with a single 
transition). A maximal path is reduced if it equals its own reduction. 

Definition 4.3 A (pseudo-) CMAEM M is tree-like if, for every s,t £ M, 
there exists at most one reduced maximal path from s to t. 

Lemma 4.4 If 9 ^ C is satisfiable in a pseudo-CMAEM, then it is satisfiable 
in a (tree-like) CMAEM. 

Proof. Suppose that 6 is satisfied in a pseudo-CMAEM M = (S, S, {7^^}yiG7'+(s) i 
{7?.^}yigp+(s),AP, L) at state s. To build a tree-like CMAEM satisfying 9, we 
use a slight modification of the standard technique of tree-unraveling. The only 
difference between our construction and the standard tree-unraveling is that the 
state space of our tree model is made up of all maximal paths in Ai rather than 
all paths whatsoever. 

Let M' = (S,S",{7^^}AeT'+(S),{'7^^}AeT'+(s),AP,i') be the submodel of 
Ai generated by s. Then, A^'. s \h 9 since Ai and A^' are locally bisimilar at s. 
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Next, we unravel into a model 7W" = (E, S"', {7^^^}^gp+(s), {7^;f }AeP+(s), 
AP, L") as follows. First, call a maximal path p in M' an s-max-path if the first 
component of p is s. Denote the last element of p by l{p). Notice that s by 
itself is an s-max-path. Now, let S be the set of all s-max-paths in M.' . For 
every A e let U*^ be {{p,p') \ p, p' € S"ixndp' = p,A,l{p')} and 

let, furthermore, TZ'j^* to be the reflexive, symmetric, and transitive closure of 
TZ*^. Notice that (p, p') G 'R-'a' holds iff one of the paths p and p' extends the 
other by a sequence of A-steps. Therefore, two different states in S" can only be 
connected by IV^ for at most one maximal coalition A. Further, we stipulate 
the following downwards closure condition: whenever (/?, t) G T^'a^ and B C A, 
then {p,t) G TZ'lf . The relations TZ'f are then defined as in any CMAEF. To 
complete the definition of A4", we put L"{p) = L'{l{p)), for every p G S". 

It is clear from the construction that M" is a pscudo-CMAEM. We will now 
show that it actually is a (tree-like) CMAEM and that it satisfies 9. To prove 
the first part of the claim, we need some extra terminology. 

We call a maximal path pi. Ai, p2, . . . , An-i, Pn in Ai" primitive if, for every 
< i < n, either G 7?,*;^. or G TZ*Ai- ^ primitive path 

pi,Ai,p2,...,An-i,Pn is non-redundant if there is no < z < n such that 
Pi = Pi+2 E^nd Ai = Ai^i. Intuitively, in a non-redundant path we never go 
from a state p (forward or backward) along a relation and then immediately 
back to p along the same relation. Since the relations TZ*'^ are edges of a tree, 
it immediately follows that: 

($) for every pair of states p^r E S", there exists at most one non-redundant 

primitive path from p to t. 

Lastly, we call a primitive path pi, A, p2, . . . , A, pn an A-primitive path. 

We will now show that maximal reduced paths in M." stand in one-to-one 
correspondence with non- redundant primitive paths. It will then follow from 
(I) that maximal reduced paths between any two states of M." are unique, 
and thus M" is tree-like, as claimed. Let P = pi, Ai, . . . , j4„_i, p„, where 
Pi = p and Pn = T, be a maximal reduced path from p to r in Ai" . Since 
{pi, Pi+i) G TZ'^ , there exists a non-redundant ^,-primitive path from pi to 
Pi+i, which in view of (J) is unique. Let us obtain a path P' from p to r by 
replacing in p every link (pi, A^, p^+i) by the corresponding non-redundant A-- 
primitive path from pi to pj+i. Call P' an expansion of P. In view of (|), every 
path has a unique expansion. Now, it is easy to see that P is a reduction of P'. 
Since the reduction of a given path is unique, too, it follows that there exists a 
one-to-one correspondence between maximal reduced paths and non-redundant 
primitive paths in A4" . 

Next, we prove that W^" = f] aeATZ"^ for every A G 7'+(E), and therefore 
that Ai" is a CMAEM. The left to right inclusion is immediate from the con- 
struction (namely, because of the downward saturation condition we imposed 
on epistemic relations). For the opposite direction, assume that {s,t) G Tl"^ 
holds for every a G A. Then, for every a € A, there exists a path, and therefore 
a maximal reduced path, from s to f along relations TZ*^, such that a G A'. As 
A4" is tree-like, there is only one maximal reduced path from s to t. Therefore, 



8 



the relations TZ^, linking s to t along this path are such that A C A' for every 
A' . Then, by the downwards closure condition, there is a path from s to t along 
the relation TZ'^ and, hence, {s,t) G TZ'^' , as desired. 

Finally, it remains to prove that A4" satisfies 9. First, notice that {p, r) e TZ'^ 
iff there exists an A-primitive path from p to r; hence, as every TZ'^^ is an equiv- 
alence relation, if (p, r) e 7^^, then {1{p)J{t)) G TZ'j^. It is now easy to check 
that the relation Z ~ {{p, l{p) \ p G S"' } is a bisimulation between M." and 
M' . Since (s, l{s)) G Z, it follows that M" , s Ih 9, and we are done. □ 

Theorem 4.5 Let 9 E C. Then, 9 is satisfiable in a CMAEM iff there exists a 
Hintikka structure for 9. 

Proof. Immediate from Theorem 13.61 and Lemma □ 



5 Tableaux for CMAEL(CD) 

5.1 Basic ideas and overview of the tableau procedure 

The tableau procedure for testing a formula 6* G £ for satisfiability is an at- 
tempt to construct a non-empty graph (called tableau) representing all pos- 
sible CMAEHSs for 9. The philosophy underlying our tableau algorithm is 
essentially the same as the one underpinning the tableau procedure for LTL 
from [TU], recently adapted to Alternating-time logic ATL in 15] and to multi- 
agent epistemic logic with operators of common and distributed knowledge for 
the whole set of agents in [4]. To make the present paper self-contained, we 
first outline the basic idea behind the tableau algorithm for CMAEL(CD), 
following ^ and |4j. The details of the tableaux presented here, obviously, are 
specific to CMAEL(CD). 

Usually, tableaux check for satisfiability by decomposing the input formula 
into "semantically simpler" formulae. In the classical propositional case, "se- 
mantically simpler" implies "smaller" , thus ensuring the termination of the pro- 
cedure. Another feature of the tableaux for classical propositional logic is that 
the decomposition into simpler formulae results in a simple tree, representing 
an exhaustive search for a model — or, to be more precise, a Hintikka set (the 
classical analogue of Hintikka structures) — for the input formula 9. If at least 
one leaf of the tree produces a Hintikka set for 9, the search has succeeded and 
9 is pronounced satisfiable. 

These two defining features of the classical tableau method do not directly 
apply to logics containing fixed point operators, such as Ca- First, decompos- 
ing of a formula Ca^ produces the formulae of the form 'Dai'fi A C^^j), which 
are not exactly "semantically simpler" ; rather, the unfolding of the monotone 
operator whose fixed point is Ca^ is effected. Hence, we cannot take termina- 
tion for granted and need to put a mechanism in place that would guarantee 
it — in our tableaux, this mechanism consists in the use of prestates, whose role 
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is to ensure the finiteness, and hence termination, of the construction. Second, 
in the classical case, the only reason why the tableau might fail to produce a 
Hintikka set for the input formula is that every attempt to build such a set 
results in a collection of formulae containing a patent inconsistency (a pair of 
formulae (p,^(p). In the case of CMAEL(CD), there are other such reasons, 
as the tableau is meant to represent CMAEHSs, which are more complicated 
structures than classical Hintikka sets. One additional possible reason for a 
failure of a node of the tableau to be satisfiable has to do with eventualities: 
the presence of an eventuality -iC^yj in the label of a state s of a CMAEHS 
requires that there is an ^-path from s to a state t whose label contains -"f. The 
analogue of this condition in the tableau is called realization of eventualities. 
Thus, all eventualities in a tableau should be realized in order for the tableau 
to be "good" , i.e. to eventually produce a Hintikka structure. The third possi- 
ble reason for existence of "bad" nodes in the tableau has to do with successor 
nodes — it may so happen that some of the successors of a node s whose satis- 
fiability is necessary for the satisfaction of s itself are unsatisfiable; a "good" 
tableau should not contain such "bad" nodes. 

The tableau procedure consists of three major phases: construction, prestate 
elimination, and state elimination. During the construction phase, we produce 
a directed graph — called the pretahleau for — whose set of nodes properly 
contains the set of nodes of the tableau we are building. Nodes of are 
sets of formulae, some of which, called states, are meant to represent states of 
a Hintikka structure, while others, called prestates, play an auxiliary, technical 
role in the construction of P^. During the prestate elimination phase, we create 
a smaller graph Tq out of V^, called the initial tableau for 9, by eliminating 
all the prestates of and adjusting its edges — prestates have already fulfilled 
their role and can be discharged. Finally, during the state elimination phase, we 
remove from Tq all the states, if any, that cannot be satisfied in any CMAEHS, 
for one of the three above-mentioned reasons. The elimination procedure results 
in a (possibly empty) subgraph of Tq , called the final tableau for 9. If some 
state A of T^ contains 9, we declare 9 satisfiable; otherwise, we declare it 
unsatisfiable. 

The reader is referred to the examples given in the Appendix, to trace all 
phases of the construction of the tableau. 

5.2 Construction phase 

At this phase, we build the pretableau — a directed graph whose nodes are 
sets of formulae, coming in two varieties: states and prestates. States are 
meant to represent states of CMAEHSs the tableau attempts to construct, 
while prestates are "embryo states", expanded into states in the course of the 
construction. Formally, states are fully expanded (recall Definition 13. ip . while 
prestates do not have to be so. Moreover, contains two types of edge. As 
already mentioned, a tableau attempt to produce a compact representation of 
all possible CMAEHSs for the input formula; in this attempt, it organizes an 
exhaustive search for such CMAEHSs. One type of edge, depicted by unmarked 



10 



double arrows =>, represents the expansion of the tableau as a search tree. 
That exhaustive search considers all possible alternatives, which arise when ex- 
panding prestates into (fully expanded) states by branching in the disjunctive 
cases. Thus, when we draw a double arrow from a prestate F to states A and A' 
(depicted as F A and F =^ A', respectively), this intuitively means that, in 
any CMAEHS, a state satisfying F has to satisfy at least one of A and A'. Our 
first construction rule, (SR), prescribes how to create states from prestates. 

Given a set F C we say that A is a minimal fully expanded extension of 
F if A is fully expanded, F C A, and there is no A' such that F C A' C A and 
A' is fully expanded. 

Rule (SR) Given a prestate F such that (SR) has not been applied to it 
before, do the following: 

1. Add all minimal fully expanded extensions A of F as states; 

2. For each so obtained state A, put F A; 

3. If, however, the pretableau already contains a state A' that coincides with 
A, do not create another copy of A', but only put F =^ A'. 

We denote by states(F) the (finite) set { A | F =^ A }. 

The second type of an edge featuring in our tableaux represents transition 
relations in the CMAEHS which it attempts to build. Accordingly, this type of 
edge is represented by single arrows marked with formulae whose presence in 
the source state requires the presence in the tableau of a target state, reachable 
by a particular relation. All such formulae have the form —Dy^ip (as can be 
seen from Definition 13. 2p . Intuitively, if, say, -iDa^ G A, then we need some 
prestate F containing -^ip to be accessible from A by 7?.^; the reason we mark 
this single arrow not just by coalition A, but by formula -iDa^, is that it helps 
us remember not just what relation connects states satisfying A and F, but why 
we had to create this particular F. This information will be needed when we 
start eliminating prestates and then states. 

The second construction rule, (DR), prescribes how to create prestates from 
states. This rule does not apply to states containing patent inconsistencies (such 
sets are called patently inconsistent), as such states cannot be satisfied in any 
CMAEHS. 

Rule (DR): Given a state A such that -^DAf G A, state A is not patently 
inconsistent, and (DR) has not been applied to it before, do the following: 

1. Create a new prestate F — {^(f} U |J a'ca{ Da'V' I '^A'i^ G A } U 
U A'caI-D^'V- I -Da'V' e A}; 

2. Connect A to F with 

3. If, however, the tableau already contains a prestate F' — F, do not add to 
it another copy of F', but simply connect A to F' with ^ 
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When building a tableau for 9 € the construction phase begins with 
creating a single prestate {9}. Afterwards, we alternate between (SR) and 
(DR): first, (SR) is applied to the prestates created at the previous stage of 
the construction, then (DR) is applied to the states created at the previous 
stage. The construction phase comes to an end when every prestate required to 
be added to the pretableau has already been added (as prescribed in point 3 of 
(SR)), or when we end up with states to which (DR) does not apply. 

Since we identify states and prestates whenever possible, to prove termina- 
tion of the construction phase it suffices to show that there are only finitely 
many possible states and prestates. For that, we use the concept of an extended 
closure of a formula. 

Definition 5.1 Let 9 ^ C. The closure of 9, denoted c\{9), is the least set of 
formulae such that 6 G c\{9), c\{9) is closed under subformulae, and the following 
conditions hold: 

• ifDAV G cl(6') and AC A' CT,, then D^'i^ G 01(6*); 

• if CaV € cl(^), then T>ai^ A Ca^) G cI(^) for every a € A. 

The extended closure of 6, denoted ecl(^?), is the least set such that, ifip G cl(^), 
then ip, ->ip G ecl(^). 

It is straightforward to check that ec\{9) is finite for every 9 and that all 
states and prestates of are subsets of ecl(^); hence, their number is indeed 
finite; hence, the construction phase terminates. 

5.3 Prestate elimination phase 

At this phase, wo remove from all the prestates and unmarked arrows, by 

applying the following rule: 

(PR) For every prestate F in "P^, do the following: 

1. Remove F from V^; 

2. If there is a state A in with A F, then for every state A' G 
states (F), put A ^ A'; 

The resultant graph is denoted Tq and called the initial tableau. 

5.4 State elimination phcise 

During this phase, we remove from Tq states that are not satisfiable in any 
CMAEHS. Recall, that there are three reasons why a state A of Tq can turn 
out to be unsatisfiable: A is patently inconsistent, or satisfiability of A requires 
satisfiability of some other unsatisfiable "successor" states, or A contains an 
eventuality that is not realized in the tableau. Accordingly, we have three 
elimination rules, (E1)-(E3). 
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Formally, the state elimination phase is divided into stages; we start at 
stage with T^; at stage n + 1, we remove from the tableau obtained at the 
previous stage exactly one state, by applying one of the elimination rules, thus 
obtaining the tableau "T^+i- We state the rules below, where denotes the 
set of states of 7^. 

(El) If {(^, -.if} CAeS^, then obtain T^_^^ by eliminating A from T^. 

(E2) If A contains a formula x = ~'^A'P and all states reachable from A 
by single arrows marked with x have been eliminated at previous stages, obtain 
1^+1 by eliminating A from 7^. 

For the third elimination rule, we need the concept of eventuality realization. 
Wc say that the eventuality ^ = ^CAf is realized at A in if either -k/J € A 
or there exists in a finite path Aq, Ai, . . . , A^ such that Aq = A, -k/j G 
Am, and for every < i < m there exist Xi = '^B'tpi such that B C A and 
Ai — ^ Ai_|-i. Wc check for realization of ^ by nmning the following marking 
procedure that marks all states that realize an eventuality ^ in 7^. Initially, we 
mark all A G such that G A. Then, we repeatedly do the following: if 

A G S"^ is unmarked and there exists at least one A' such that A ^ A' for 
some B <Z A and A' is marked, then A gets marked. The procedure ends when 
no more states get marked at a current round of marking. Note that marking 
is carried out with respect to a fixed eventuality ^ and is, therefore, repeated 
as many times as the rnimber of eventualities in (the states) of a tableau. Now, 
we can state our last rule. 

(E3) If A G 5^ contains an eventuality -iC^<p that is not realized at A in 
T^, then obtain T^_^_i by removing A from T^. 

We have so far described individual rules; to describe the state elimination 
phase as a whole, we must specify the order of their application. First, we apply 
(El) to all the states of Tq; once this is done, we do not need to apply (El) 
again. The cases of (E2) and (E3) are more involved. After having applied 
(E3) we could have removed all the states accessible from some A along the 
arrows marked with some formula xi hence, we need to reapply (E2) to the 
resultant tableau to remove such A's. Conversely, after having applied (E2), 
we could have thrown away some states that were needed for realizing certain 
eventualities; hence, we need to reapply (E3). Therefore, we need to apply 
(E3) and (E2) in a dovetailed sequence that cycles through all the eventualities. 
More precisely, we arrange all eventualities occurring in the tableau obtained 
from Tq after having applied (El) in a list: ^i,...,^m- Then, we proceed 
in cycles. Each cycle consists of alternatingly applying (E3) to the pending 
eventuality (starting with ^i), and then applying (E2) to the resulting tableau, 
until all the eventualities have been dealt with. These cycles are repeated until 
no state is removed in a whole cycle. Then, the state elimination phase is over. 

The graph produced at the end of the state elimination phase is called the 
final tableau for 6, denoted by and its set of states is denoted by S^. 

Definition 5.2 The final tableau is open if 6 & A for some A G ; other- 
wise, is closed. 
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The tableau procedure returns "no" if the final tableau is closed; otherwise, 
it returns "yes" and, moreover, provides sufficient information for producing a 
finite model satisfying 9; that construction is sketched in Section [51 

6 Soundness, completeness, and complexity 

The soundness of a tableau procedure amounts to claiming that if the input 
formula 9 is satisfiable, then the tableau for 9 is open. To establish soundness of 
the overall procedure, we use a series of lemmas showing that every rule by itself 
is sound; the soundness of the overall procedure is then an easy consequence. 
The proofs of the following two lemmas are straightforward. 

Lemma 6.1 Let T be a prestate of such that M, s Ih T for some CMAEM 
M and s E M. Then, M.,s Ih A holds for at least one A e states (F). 

Lemma 6.2 Let A e be such that M,s \h A for some CMAEM M and 
s Q Ai, and let -^Dy^ip £ A. Then, there exists t ^ Ai such that {s, t) e TZ^ and 
M,t Ih {^ip} U U a'ca{D^,V I D^'V' e A} U U a'ca{-Da'V^ | -D^'V' e 
A}. 

Lemma 6.3 Let A e be such that M,s Ih A for some CMAEM M and 
s G M, and let -iC^(y5 G A. Then, ^Ca^p is realized at A in . 

Proof idea. As ^Ca^ is true at s, there is a path in M from s leading to a 
state satisfying -^ip. As the tableaux organize the exhaustive search, a chain of 
tableau states corresponding to those states in the model will be produced. □ 

Theorem 6.4 If 9 e C is satisfiable in a CMAEM, then is open. 

Proof sketch. Using the preceding lemmas, show by induction on the number 
of stages in the state elimination process that no satisfiable state can be elimi- 
nated due to (E1)-(E3). The claim then follows from Lemma [Ql □ 

The completeness of a tableau procedure means that if the tableau for a 
formula 9 is open, then 9 is satisfiable in a CMAEM. In view of Theorem l4.5[ it 
suffices to show that an open tableau for 9 can be turned into a CMAEHS for 
9. 

Lemma 6.5 //T^ is open, then there exists a CMAEHS for 9. 

Proof sketch. The CMAEHS Ti for 9 is built out of the so-called final tree com- 
ponents. Each component is a tree-like CMAES with nodes labeled with states 
from , and is associated with a state A G and an eventuality ^ G c\{9) 
(such a component is denoted by 7a, ^). If ^ ^ A, then Ta,^ is a simple tree, 
whose root is labeled with A, that has exactly one leaf associated with each 
formula -iD^?/; marking an arrow from A to some A' G S*^; this leaf is labeled 
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by A' and connected to the root by relation TZ^- If C G take the chain 
reahzing x at A and give each node "enough" successors, as prescribed above 
for simple trees. The crucial fact is that if is an eventuality in A that is not 
"realized" inside Ta,^, then ^' belongs to every leaf of Ta,^. This allows us to 
stitch up all the T'a,^'s into a Hintikka structure. The procedure is recursive. All 
the eventualities are queued. We start from the component uniquely associated 
with 9 (say, we take TA,e where A is the least numbered state containing 9; such 
a state exists as the tableau is open) and then replace each leaf of the structure 
built so far with the component associated with the set marking the leaf and the 
pending eventuality. The procedure is repeated in cycles until we have attached 
enough components to realize all eventualities. To obtain a CMAEHS, we put 
H{A) = A for aU A's. □ 

Theorem 6.6 (Completeness) Let 9 € C and let be open. Then, 9 is 
satisfiable in a CMAEM. 

Proof. Immediate from Lemma 16.51 and Theorem 14. 5 1 □ 

As for complexity of the procedure, for lack of space, we only state that our 
procedure runs within 0(fc^" ) steps, where n is the size of the input formula 
and k is the number of agents in the language. Therefore, the CMAEL(CD)- 
satisfiability is in ExpTime, which together with the ExpTime-hardness result 
from [7] for a fragment of our logic containing, along with individual knowledge 
modalities, the common knowledge operatore for the whole set of agents, implies 
that CMAEL(CD)-satisfiability is ExpTime-complete. 

7 Concluding remarks 

We have developed a sound and complete, incremental-tableau-based decision 
procedure for the full coalitional multiagent epistemic logic CMAEL(CD). 
We are convinced that this style of tableaux is more intuitive, practically more 
efficient and more adaptable than the top-down style of tableaux e.g., developed 
for a fragment of this logic in ^ , and therefore is suitable both for manual and 
automated execution. In particular, it is amenable to extension with operators 
for strategic abilities of the Alternating-time temporal logic ATL, a tableaux 
for which were developed in [3]. Merging these two systems is a topic of our 
future work. 
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A Examples 

Example 1 Let6 = -^T)^a c}C{a.b}P^C^a,b}{p^<l), whereT, = {a,b,c}. To save 
space, we replace 6 by the set of its conjuncts & = {~'D{a,c}C'{a,b}P: f,}(p /\ 
q)}. We also use some heuristics that we did not have space to discuss in the 
main part of the paper (they will, however, be explained in a follow up work). 
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The picture on the left below represents the final pretableau for Q, while the 
picture on the right represents the initial tableau. Under the pictures we list 
formulae that occur in the labels of states and prestates. 



To = {-iD{a,c}C{„,6}p, C{„_b}(p A g)}; 

Ao = {-.D{„,^jCt„,t,jp, D„[(p A 9) A C{„,6}(p A q)],Db[{p A g) A C{„,6j (p A g)]}; 
Ti = {-.C{„,(,}p,Da[(pA9) AC{„,6}(pAg)]},• 
Al = {-D„(p A C{,,5}p), Da[{p Aq)A C{„,6}(p A q)]}; 
A2 = {^D6(pAC{„,f,}p),D6[(pAg) AC{,,fc}(pAg)]}; 
^2 = {^(pAC{„,6}p),(pAg) AC{<,,6}(pAq)}; 

A3 = {-'P, (p A A C{a,6}(p /\q),P^q,P,q, Da[(p a g) a C{„,6}(p a q)], 

D6[(pA<7) AC{„,i,}(pAg)]}; 
A4 = {^C{„,5}p, -.Da(p A C{„,f,}P), (P A g) A C{<j,f,}(p A q),pAq,p,q, 

Galip Aq)A C^aM (p A g)], D6[(p A g) A C^^.tyip ^ 'l)]}: 
As = {^C{„,6}P,-.D6(p A C{„,i,}p), (p Ag) A C{„,5}(p A g),p A g,p,g, 

D„[(p A g) A C{„^5} (p A g)], D^Kp A g) A C{„.6}(p A g)]}. 

During the state- elimination phase, the state A3 is removed due to (El), 
as it contains a patent inconsistency (p,^p). Then, the states Ai, A2, A4, and 
A5 are eliminated due to (E3), as all of them contain the unrealized eventuality 
-iC{(j,6}P- Finally, Aq gets eliminated, as it has lost all its successors along 
the arrow marked with xo- Thus, the final tableau for 6 is an empty graph; 
therefore, 9 is unsatisfiable. 

Example 2 Let 6 = C[a,b}P ^ C{f,,c}l' ^ ^C{a.c}P> where E = {a,b,c}. Once 
again, to save space, we replace 6 with G = {C{a.b}P:C{b.c}P:~'C^{a.c}P}- The 
picture below shows the final pretableau for Q; the initial tableau is easily ex- 
tracted from it, as in the previous example. Formulae that occur in the labels of 
states and prestates are listed under the picture. 
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Xl = -'Da(p A Cla,c}P); X2 = -'Dc(p A C{„,c}P); 
To = {C{o,6}P, C{6,c}P, ~'C{a,c}P}/ 

^1 = {C{a,6}P, C{(,,e}P, -'C{„,c}P, Da(p A C^;^,;,}^), Di,(p A C{„,i,}p), D6(p A C{[,,c}P), 

Dc(pA C{6,c}P),^Da (p A C{,,,c}p)}; 

A2 = {C{a,f,}P, C{b,c}P, -^C{a,c)P, Da(p A C{a,6}p) , Dfc (p A C{a,b}P), ^b{j> A C{i,,c}P), 

Dc(p A C{6,c}P), -'Dc(p A C{a,c}P)}; 
Tl = {-.(p A C{„,e}P), DaO) A C{a,(,}p)}; 

r2 = {^{p A C{„,e}3?), Dc(3? A C{b,c}P)}; 

A3 = {^C{„_c}P,Da(p A C{„_b}p),-.Da(p A C{„,<,}P)}; 

A4 = {^C{„,c}P,Da(p A C{„_b}p),-.Dc(p A C{„,c}P}; 
As = {-•p,Da(pAC{„_b}p),pAC{„_b}p,p, C|a,5}p}; 
Ae = {-'P,Dc(pAC{6,c}P),pAC{b,e}P,P, C|f,,c}p}; 

A7 = {-.C{a,c}?>, Dc(p A C{6,c}P), -'Da(p A C{a,c)P]; 

Ag = {^C{„,c}P, Dc(p A C{i,,c}P), -'Dc(p A C{a,c}P}; 

rs = {^(pAC{,,,}p)} 

Ag = {-nC{a,c}P, ^Da(p A C{a,c}P)}; 
AlO = {-.C{„,c}P,-'Dc(pA C{a,c})}/ 

All = {^p}. 

t/ie state elimination phase, states A5 and Ag ^ei removed due to (El). 
All other states remain in place; in particular, no states gets elirninated due to 
(E3), because, from any state one can reach either Ag or A13, both of which 
contain -^p, and our only eventuality is ^C^a,c}P- Thus, 6 is satisfiable, and a 
Hintikka structure for it is readily extracted from the final tableau. 
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